Audit Log - User shown as App@sharepoint

Silver Contributor

When I do a search of an audit log in the S&C Center for the Created Site Collection activity, many of the results show a User of app@sharepoint, many other results show real user accounts.

Does anyone know what would cause this activity to be performed by the app@sharepoint account?

3 Replies

I ran some more tests and determined that when a user creates an a group from Yammer, Outlook or Teams, then the Unified log shows the creation of the Site Collection as being created by  because this service account is run on behalf of the actual creator.

@Dean Gross 


Hi Dean, i'm replying to an old thread of yours.


I was wondering. How did you found out who were the actual users when you saw app@sharepoint in your audit log? I see the same, but i can't find a way to link it to an actual user.

Sorry, I'm not sure, but it was probably by looking at the time of the event